audit log for "setenforce" changes?
Stephen Smalley
sds at tycho.nsa.gov
Fri Jan 11 21:16:21 UTC 2008
On Fri, 2008-01-11 at 16:06 -0500, Chuck Anderson wrote:
> Is there any way to tell from the audit log or elsewhere when
> someone/something changed SELinux from enforcing to permissive or vice
> versa?
Look for MAC_STATUS records in the audit log, e.g.
/sbin/ausearch -m MAC_STATUS
These include changes to enforcing mode, with the enforcing= and
old_enforcing= values.
--
Stephen Smalley
National Security Agency
More information about the fedora-selinux-list
mailing list